CVSS base score
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp_abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp_abspath values to simple_fields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allow_url_include is enabled.
Explanation of Vulnerability in Simple Terms
Simple Fields versions 0.2 through 0.3.5 contain a local code execution vulnerability. An attacker with local access to the system can exploit this flaw to read sensitive files without requiring authentication or user interaction. The vulnerability stems from improper input handling that allows unauthorized access to confidential data on the affected system.
What an attacker can do
Read sensitive files on the server without authentication.
Potential impact on your site
If Simple Fields runs on your server, a local attacker can access confidential data stored by the plugin.
Conditions required to exploit
Local access to the server; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
